Sun Cobalt RaQ 4.0 - Predictable Temporary Filename Symbolic Link Attack

source: https://www.securityfocus.com/bid/5529/info A vulnerability has been reported in Cobalt RaQ that may allow attackers to obtain elevated privileges. The vulnerability exists in the /usr/lib/authenticate utility which is used by Apache for authentication purposes. Reportedly, the utility...

CVE-2000-0006

strace allows local users to read arbitrary files via memory mapped file names...

CVE-1999-1440

Win32 ICQ 98a 1.30, and possibly other versions, does not display the entire portion of long filenames, which could allow attackers to send an executable file with a long name that contains so many spaces that the .exe extension is not displayed, which could make the user believe that the file is...

Обратный путь в директориях в функциях fts из libc (directory traversal)

Сконструировав специальные имена файлов можно выйти за пределы дерева директорий...

CVE-2000-1198

qpopper POP server creates lock files with predictable names, which allows local users to cause a denial of service for other users lack of mail access by creating lock files for other mail boxes...

Получение исходного текста CGI в Bad Blue (source code retrieval)

Додбавив 00 к имени файла PHP или CGI можно получить его исходный код...

ZoneAlarm Pro's MailSafe

hi2all MailSafe is a feature on ZoneAlarm Pro http://www.zonelabs.com that identifies in e-mail attachments potentially harmful files ex: .exe, .com, .reg, .vbs or others that can be added in this feature configuration, and renames their extension to .zl; at the same time it can show an alarm box...

Проблемы с man в Slackware (weak permissions)

Директории /var/man/cat открыты на запись, что позволяет создать файлы с именами содержащими sh-символы, которые будут выполнены при вызове команды man...

CVE-2001-1146

AllCommerce with debugging enabled in EnGarde Secure Linux 1.0.1 creates temporary files with predictable names, which allows local users to modify files via a symlink attack...

ml85p - driver for Samsung ML-85G and /tmp

ml85p - driver for Samsung ML-85G GDI printers seems to use /tmp unsecurely. it seems to use the time function to determine the /tmp files name. root@linux exp strings /usr/bin/ml85p | grep tmp /tmp/ml85gd 401070dd iopl0x3 = 0 400cf2bd timeNULL = 994462668 40100cbf brk0 = 0x8064544 40100cbf...

CVE-2001-0310

sort in FreeBSD 4.1.1 and earlier, and possibly other operating systems, uses predictable temporary file names and does not properly handle when the temporary file already exists, which causes sort to crash and possibly impacts security-sensitive scripts...

CVE-2001-0310

sort in FreeBSD 4.1.1 and earlier, and possibly other operating systems, uses predictable temporary file names and does not properly handle when the temporary file already exists, which causes sort to crash and possibly impacts security-sensitive scripts...

CVE-2001-0310

The issue is with the UNIX sort utility on FreeBSD 4.1.1 and earlier, where temporary files are created with predictable names and not properly handled when the file already exists. This can cause sort to crash, effectively denying service to scripts or administration tasks that rely on sort. Pub...

Дырка в Microfocus Cobol

При установке создаются файлы открытые на запись и временные файлы с предсказуемыми именами...

CVE-2000-1096

The CVE-2000-1096 entry concerns the crontab utility by Paul Vixie, where temporary files are created with predictable names and there is insufficient verification that the file is owned by the user running crontab -e. This enables local users who have write access to the crontab spool directory ...

ReiserFS 3.5.28 (Linux Kernel) - Code Execution Denial of Service

ReiserFS 3.5.28 Linux Kernel - Code Execution Denial of Service source: https://www.securityfocus.com/bid/2180/info ReiserFS is a file system alternative to the Linux ext2 file system. It was originally written by Hans Reiser, and is freely available and publicly maintained. A problem has been...

ReiserFS 3.5.28 (Linux Kernel) - Code Execution / Denial of Service

source: https://www.securityfocus.com/bid/2180/info ReiserFS is a file system alternative to the Linux ext2 file system. It was originally written by Hans Reiser, and is freely available and publicly maintained. A problem has been reported in the handling of long file names with ReiserFS version...

CVE-2000-0338

Summary: CVE-2000-0338 affects Concurrent Versions Software (CVS). The vulnerability arises from predictable temporary file names used for locking, enabling a local user to pre-create the lock directory before the legitimate CVS process, causing a denial of service. Impact (as described): local a...

CVE-2000-0477

Buffer overflow in Norton Antivirus for Exchange NavExchange allows remote attackers to cause a denial of service via a .zip file that contains long file names...

CVE-2000-0579

IRIX crontab creates temporary files with predictable file names and with the umask of the user, which could allow local users to modify another user's crontab file as it is being edited...